Identification systems : a risk assessment framework
Russell Smith · 2006
Identity-related crime affects all sectors of society - and robust measures are needed to guard against its increase. There are various mechanisms used by organisations to verify the evidence of a person's identity and an important goal is to ensure that any system is as effective and efficient as possible. This paper provides a framework for assessing the competing factors that decision makers need to address when determining the effectiveness and efficiency of any proposed identity checking system. Ten groups of factors are identified, against which each system can be assessed, and a framework for quantitative analysis is provided. The adoption of any given solution must be driven by an objective assessment of evidence relating to all of these factors - not solely those governing technical performance measures. Toni Makkai Director Identifying people with certainty is time consuming and costly for public and private sector organisations. Each year in Australia, government agencies need to identify approximately half a million new Australian residents, 2.5 million enrolment forms are processed by the Australian Electoral Commission, the Australian Taxation Office issues almost half a million new tax file numbers, Centrelink grants 2.8 million new claims for benefits, and the Department of Foreign Affairs and Trade issues over one million travel documents (websites listed in references). On each occasion, evidence of identity is required. In addition, millions of people every day logon to computer networks, for work, to withdraw cash from automated teller machines (ATMs), or to use the internet for recreation or business. In 2005, the Reserve Bank reported that there were 772 million ATM withdrawals and 1 ,1 76 million electronic funds transfer at point of sale (EFTPOS) transactions in Australia (APCA 2006), each of which required customers to identify themselves by entering a personal identification number (PIN). There are also millions of occasions each year on which individuals need to be identified for access to buildings, travel purposes, and proof of age for purchasing alcohol and cigarettes. Failure to have effective means of identification creates opportunities for criminal activity. It has recently been estimated that identity-related fraud alone cost $1 .1 billion in Australia in 2002 (Cuganesan & Lacey 2003). This paper provides a framework for evaluating three principal approaches to identifying people for government and business purposes. The 100 point system The 100 point system of identification, which operates throughout Australia, relies on people submitting documents for inspection at government agencies or financial institutions. Each document is assigned a value depending upon its level of security. Primary documents (which carry 70 points each) include certificates of citizenship, passports, and birth certificates. Secondary documents include drivers' licences (40 points), public employee or student ID cards (40 points), credit cards (25 points), Medicare cards (25 points), and council rates notices (25 points). There is a range of other documents that can be used to verify name and address, each carrying different numbers of points. At present under the Financial Transaction Reports Regulations 1 990 (Cth), 1 00 points of documentation are required to open an account with a financial institution as well as for establishing identity for the most secure forms of electronic communications with government. Biometrics In recent years, biometrie technologies have developed as a means of identifying people. Biometrics has been defined as 'the automated means of recognising a living person through the measurement of distinguishing physiological or behavioural traits' (Great Britain, Biometrics Working Group 2002: 4), In other words, biometrie systems are based on who people are, rather than what they carry with them such as a card, or what they know, such as a password. …